CVE-2026-66883: oidcc_plug 0.1.0-alpha.3 to before 0.5.0

Affected technology

oidcc_plug · 0.1.0-alpha.3 to before 0.5.0
Erlang Ecosystem Foundation

oidcc_plug · 0a75fb139d8e2686d1b75e0d48962323d2181673 to before f15e52c5750aaba701104b10ed96cfac063bd557
Erlang Ecosystem Foundation

Component: Elixir.Oidcc.Plug.Authorize, Elixir.Oidcc.Plug.AuthorizationCallback
Function: 'Elixir.Oidcc.Plug.Authorize':call/2, 'Elixir.Oidcc.Plug.AuthorizationCallback':call/2
File: lib/oidcc/plug/authorize.ex, lib/oidcc/plug/authorization_callback.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.